Cross-Architecture Binary Code Similarity-Detection Method Based on Contextual Information
Source abstract
Abstract
With the rapid growth of software scale, binary code similarity detection is of great significance in security analysis tasks, such as malicious code detection and vulnerability mining. However, due to differences in instruction sets and inconsistent intermediate languages used by different compilers, with existing methods it is difficult to effectively implement cross-architecture detection. To address the problem of insufficient cross-architecture feature extraction in existing methods, we propose a cross-architecture binary code similarity-detection method based on contextual information. We design an assembly instruction-classification method that maps instructions implementing the same function under different architectures to the same semantic space, and makes the model learn the common features of semantically similar instructions under different architectures more efficiently through comparative learning to better capture semantic context information. In order to better capture the contextual structural information between basic blocks, we introduce graph attention neural networks to reduce the interference of noisy nodes that contain fewer instructions. The combination of semantic contextual information as well as structural contextual information ultimately improves the detection accuracy. Experimental results show that compared with existing methods, the proposed method has better performance in accuracy, precision, recall and F1-score.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Software Engineering Research · Advanced Malware Detection Techniques · Web Data Mining and Analysis
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
State Key Laboratory of Networking and Switching Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China
Funding
National Natural Science Foundation of China
References (35)
Show source-provided references
1. Wang, J., Zhang, C., Chen, L., Rong, Y., Wu, Y., Wang, H., Tan, W., Li, Q., and Li, Z. (2024, January 14–16). Improving ML-based Binary Function Similarity Detection by Assessing and Deprioritizing Control Flow Graph Features. Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, USA.
2. Survey on dependency conflict problem of third-party libraries
3. Software reuse cuts both ways: An empirical analysis of its relationship with security vulnerabilities10.1016/j.jss.2020.110653 ↗
4. (2025, January 15). Heartbleed Vulnerability. Available online: https://openssl-library.org/news/vulnerabilities/index.html#CVE-2014-0160.
5. Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J., Payer, M., Weaver, N., Adrian, D., Paxson, V., and Bailey, M. (2014, January 5–7). The matter of heartbleed. Proceedings of the 2014 Conference on Internet Measurement Conference, Vancouver, BC, Canada.10.1145/2663716.2663755 ↗
6. A survey of binary code similarity detection techniques based on machine learning
7. Binary function similarity detection based on neural machine translation
8. Hu, Y., Zhang, Y., Li, J., and Gu, D. (2017, January 22–23). Binary code clone detection across architectures and compiling configurations. Proceedings of the 2017 IEEE/ACM 25th International Conference on Program Comprehension (ICPC), Buenos Aires, Argentina.10.1109/ICPC.2017.22 ↗
9. Fossil: A resilient and efficient system for identifying foss functions in malware binaries10.1145/3175492 ↗
10. Ren, X., Ho, M., Ming, J., Lei, Y., and Li, L. (2021, January 20–25). Unleashing the hidden power of compiler optimization on binary code difference: An empirical study. Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation, Virtual.10.1145/3453483.3454035 ↗
11. MalDAE: Detecting and explaining malware based on correlation and fusion of static and dynamic characteristics10.1016/j.cose.2019.02.007 ↗
12. Moussas, V., and Andreatos, A. (2021). Malware detection based on code visualization and two-level classification. Information, 12.10.3390/info12030118 ↗
13. Malware-on-the-brain: Illuminating malware byte codes with images for malware classification10.1109/TC.2022.3160357 ↗
14. Marastoni, N., Giacobazzi, R., and Dalla Preda, M. (2018, January 3). A deep learning approach to program similarity. Proceedings of the 1st International Workshop on Machine Learning and Software Engineering in Symbiosis, Montpellier, France.10.1145/3243127.3243131 ↗
15. Liu, B., Huo, W., Zhang, C., Li, W., Li, F., Piao, A., and Zou, W. (2018, January 3–7). αdiff: Cross-version binary code similarity detection with dnn. Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineering, Montpellier, France.10.1145/3238147.3238199 ↗
16. What you see is what it means! semantic representation learning of code based on visualization and transfer learning10.1145/3485135 ↗
17. Massarelli, L., Di Luna, G.A., Petroni, F., Baldoni, R., and Querzoni, L. (2019, January 19–20). Safe: Self-attentive function embeddings for binary similarity. Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Gothenburg, Sweden.10.1007/978-3-030-22038-9_15 ↗
18. Zuo, F., Li, X., Young, P., Luo, L., Zeng, Q., and Zhang, Z. (2018). Neural machine translation inspired binary code similarity comparison beyond function pairs. arXiv.10.14722/ndss.2019.23492 ↗
19. Ding, S.H., Fung, B.C., and Charland, P. (2019, January 19–23). Asm2vec: Boosting static representation robustness for binary clone search against code obfuscation and compiler optimization. Proceedings of the 2019 IEEE Symposium on Security and Privacy (sp), San Francisco, CA, USA.10.1109/SP.2019.00003 ↗
20. Luo, Z., Wang, B., Tang, Y., and Xie, W. (2019). Semantic-based representation binary clone detection for cross-architectures in the internet of things. Appl. Sci., 9.10.3390/app9163283 ↗
21. Codee: A tensor embedding scheme for binary code search10.1109/TSE.2021.3056139 ↗
22. BinDeep: A deep learning approach to binary code similarity detection10.1016/j.eswa.2020.114348 ↗
23. Li, X., Qu, Y., and Yin, H. (2021, January 15–19). Palmtree: Learning an assembly language model for instruction embedding. Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, Virtual.10.1145/3460120.3484587 ↗
24. Wang, H., Qu, W., Katz, G., Zhu, W., Gao, Z., Qiu, H., Zhuge, J., and Zhang, C. (2022, January 18–22). Jtrans: Jump-aware transformer for binary code similarity detection. Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual.10.1145/3533767.3534367 ↗
25. Ahn, S., Ahn, S., Koo, H., and Paek, Y. (2022, January 5–9). Practical binary code similarity detection with bert-based transferable similarity learning. Proceedings of the 38th Annual Computer Security Applications Conference, Austin, TX, USA.10.1145/3564625.3567975 ↗
26. Xu, X., Liu, C., Feng, Q., Yin, H., Song, L., and Song, D. (November, January 30). Neural network-based graph embedding for cross-platform binary code similarity detection. Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, Dallas, TX, USA.10.1145/3133956.3134018 ↗
27. Gao, J., Yang, X., Fu, Y., Jiang, Y., Shi, H., and Sun, J. (2018, January 4–9). Vulseeker-pro: Enhanced semantic learning based binary vulnerability seeker with emulation. Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Lake Buena Vista, FL, USA.10.1145/3236024.3275524 ↗
28. Massarelli, L., Di Luna, G.A., Petroni, F., Querzoni, L., and Baldoni, R. (2019, January 24). Investigating graph embedding neural networks with unsupervised features extraction for binary analysis. Proceedings of the 2nd Workshop on Binary Analysis Research (BAR), San Diego, CA, USA.10.14722/bar.2019.23020 ↗
29. Bowman, B., and Huang, H.H. (2020, January 7–11). VGRAPH: A robust vulnerable code clone detection system using code property triplets. Proceedings of the 2020 IEEE European Symposium on Security and Privacy (EuroS&P), Genoa, Italy.10.1109/EuroSP48549.2020.00012 ↗
30. Wang, W., Li, G., Ma, B., Xia, X., and Jin, Z. (2020, January 18–21). Detecting code clones with graph neural network and flow-augmented abstract syntax tree. Proceedings of the 2020 IEEE 27th International Conference on Software Analysis, Evolution and Reengineering (SANER), London, ON, Canada.10.1109/SANER48275.2020.9054857 ↗
31. Kim, G., Hong, S., Franz, M., and Song, D. (2022, January 18–22). Improving cross-platform binary analysis using representation learning via graph alignment. Proceedings of the 31st ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual.10.1145/3533767.3534383 ↗
32. He, H., Lin, X., Weng, Z., Zhao, R., Gan, S., Chen, L., Ji, Y., Wang, J., and Xue, Z. (2024, January 14–16). Code is not Natural Language: Unlock the Power of Semantics-Oriented Graph Representation for Binary Code Similarity Detection. Proceedings of the 33rd USENIX Security Symposium (USENIX Security 24), Philadelphia, PA, USA.
33. Jia, A., Fan, M., Xu, X., Jin, W., Wang, H., and Liu, T. (2024, January 14–20). Cross-inlining binary function similarity detection. Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, Lisbon, Portugal.10.1145/3597503.3639080 ↗
34. Revisiting binary code similarity analysis using interpretable feature engineering and lessons learned10.1109/TSE.2022.3187689 ↗
35. Yu, Z., Cao, R., Tang, Q., Nie, S., Huang, J., and Wu, S. (2020, January 7–12). Order matters: Semantic-aware neural networks for binary code similarity detection. Proceedings of the AAAI Conference on Artificial Intelligence, New York, NY, USA.10.1609/aaai.v34i01.5466 ↗